Linux – Best practices for web server log archiving (Linux + Nginx)

linuxlog-fileslogrotatenginxweb-server

I want to preserve/archive all of my web server logs, and not have any of them be deleted by logrotate. What would a recommended approach be for this? This is a Linux box, running Nginx. Thanks in advance.

(I would prefer to use cronolog, but it appears to not go well with Nginx because of the way Nginx handles logging.)

Best Answer

Do it with logrotate, just tell it what you want...

/var/log/nginx/*.log {
    daily
    dateext
    missingok
    rotate 7305 # 2 decades
    olddir /var/log/nginx/old
    compress
    delaycompress
    notifempty
    create 644 nginx root
    sharedscripts
    postrotate
      if [ -f /var/run/nginx.pid ]; then
        kill -USR1 `cat /var/run/nginx.pid`
      fi
    endscript
}

I don't use nginx, so I used an example I found for the postrotate... If you have a logrotate script already, start with modifying that.

Key parts:

  • "daily" means every day. You could do weekly or size-based, but that doesn't interact as prettily with "dateext".
  • "dateext" means it'll give the rotated logfiles a name based on the date instead of a simple number; that way it doesn't have to rename every log file every day and you can tell the date of a logfile from the name of the file
  • "rotate 7305" -- this is two decades. Keep more or less... logrotate really prefers to have some sort of retirement, but you can set it ridiculously high.
  • "olddir" has to be on the same filesystem, but that'll keep the logs in a separate dir so you can figure out what's going on
  • "delaycompress" and "create" help make sure it works with software that doesn't want to work with it
Related Topic